EMA Points to Web Browsers as Emerging IT Security Threat

BOULDER, Colo., Feb. 26 /PRNewswire/ -- Web browsers have emerged as a favorite vulnerability point for nefarious attackers looking to breach corporate IT security systems. Vital to everyday business operations, the Web browser must be protected from malware lurking on a fast-growing number of infected Web sites, according to Enterprise Management Associates (EMA) http://www.enterprisemanagement.com, a leading IT management research and consulting firm.

By

Tuesday, February 26th, 2008

BOULDER, Colo., Feb. 26 /PRNewswire/ — Web browsers have emerged as a favorite vulnerability point for nefarious attackers looking to breach corporate IT security systems. Vital to everyday business operations, the Web browser must be protected from malware lurking on a fast-growing number of infected Web sites, according to Enterprise Management Associates (EMA) http://www.enterprisemanagement.com, a leading IT management research and consulting firm.

According to recent analysis by Mike Montecillo, analyst, security and risk management for EMA (Fear Your Browser: It May be the Biggest Hole in Your Security Strategy), the increasing technology integrated into today's Web browsers has made them an easy target for computer attackers and hackers. Hacking continues to evolve in sophistication and the Web browser now presents an opening for sensitive information to be stolen by increasingly simple methods. This includes basic coding that allows malicious Web sites to automatically steal sensitive information from visitors. Commonly associated with "seedy" Web sites ("warez," gambling and pornography), the threat of browser-based attacks has expanded to more "acceptable" sites that might include social networking, religious organization and university sites.

Further complicating the issue is the high demand for browser functionality that often outweighs the demand for security. Many well-known and useful technologies that are integrated with current browser environments, including Flash, ActiveX, QuickTime, Java and JavaScript, each pose a potential attack vector into the enterprise. Other vulnerabilities include how browsers themselves handle particular pieces of code, such as iFrames, whose weaknesses have been known to cause massive incidents in enterprises when exploited.

"Each and every Web site is a potential host for malicious code as hackers could potentially exploit even the most legitimate site as a means of hacking thousands of computers without the fear of reprisal," said Montecillo. "There is no end in sight to the number of malicious Web sites and browser-related vulnerabilities that can end up causing enterprise-wide breaches and incidents."

To help thwart browser-based security threats, IT security professionals increasingly are focusing resources and attention at better protecting the Web browser through hardy URL filtering solutions. These Web content filtering solutions block sites that are not related to business activities, greatly reducing the risk of browser-related infections. However, simple filtering methods will not completely eliminate the malware danger. More sophisticated solutions, such as anti-malware, automated code filtering and botnet detection, are currently being added to Web filtering technologies in an effort to thwart complex browser-related attacks.

Looking forward, EMA believes that the number of Web pages posing a serious threat to corporate IT will continue to increase at an alarming rate, raising browser vulnerabilities throughout 2008. Given the continued demand for an ever-wider range of browser functionality, Montecillo does not expect root-cause fixes to happen within the browser application. He does, however, anticipate that IT security vendors will launch new and innovative solutions during the year to advance Web content filtering to higher levels to meet the needs of increasingly sophisticated browser-based security strategies.

For information on security tools available to defend against Web-based attacks please visit EMA's Security Solutions Centers at http://itsolutions.emausa.com.

NOTE TO EDITORS:

For more information on this topic or to arrange an interview with Mike Montecillo, please contact Guy Murrel at gmurrel@catapultpr-ir.com or 303-581-7760 x17.

About Enterprise Management Associates

Founded in 1996, Enterprise Management Associates (EMA) is a leading industry analyst and consulting firm dedicated to the IT management market. The firm provides IT vendors and enterprise IT professionals with objective insight into the real-world business value of long-established and emerging technologies, ranging from security, storage and IT Service Management (ITSM) to the Configuration Management Database (CMDB), virtualization and service- oriented architecture (SOA). Even with its rapid growth, EMA has never lost sight of the client, and continues to offer personalized support and convenient access to its analysts. For more information on the firm's extensive library of IT management research, free online IT Management Solutions Center and IT consulting offerings, visit http://www.enterprisemanagement.com.